Query data in Azure Monitor using Azure Data Explorer (Preview)

The Azure Data Explorer proxy cluster (ADX Proxy) is an entity that enables you to perform cross product queries between Azure Data Explorer, Application Insights (AI), and Log Analytics (LA) in the Azure Monitor service. You can map Azure Monitor Log Analytics workspaces or Application Insights apps as proxy clusters. You can then query the proxy cluster using Azure Data Explorer tools and refer to it in a cross cluster query. The article shows how to connect to a proxy cluster, add a proxy cluster to Azure Data Explorer Web UI, and run queries against your AI apps or LA workspaces from Azure Data Explorer.

The Azure Data Explorer proxy flow:

ADX proxy flow

Prerequisites

Note

The ADX Proxy is in preview mode. Connect to the proxy to enable the ADX proxy feature for your clusters. Contact the ADXProxy team with any questions.

Connect to the proxy

  1. Verify your Azure Data Explorer native cluster (such as help cluster) appears on the left menu before you connect to your Log Analytics or Application Insights cluster.

    ADX native cluster

  2. In the Azure Data Explorer UI (https://dataexplorer.azure.com/clusters), select Add Cluster.

  3. In the Add Cluster window, add the URL to the LA or AI cluster.

    • For LA: https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>

    • For AI: https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.insights/components/<ai-app-name>

    • Select Add.

    Add cluster

    If you add a connection to more than one proxy cluster, give each a different name. Otherwise they'll all have the same name in the left pane.

  4. After the connection is established, your LA or AI cluster will appear in the left pane with your native ADX cluster.

    Log Analytics and Azure Data Explorer clusters

Run queries

You can run the queries using client tools that support Kusto queries, such as: Kusto Explorer, ADX Web UI, Jupyter Kqlmagic, Flow, PowerQuery, PowerShell, Jarvis, Lens, REST API.

Tip

  • Database name should have the same name as the resource specified in the proxy cluster. Names are case sensitive.
  • In cross cluster queries, make sure that the naming of Application Insights apps and Log Analytics workspaces is correct.
    • If names contain special characters, they're replaced by URL encoding in the proxy cluster name.
    • If names include characters that don't meet KQL identifier name rules, they are replaced by the dash - character.

Direct query from your LA or AI ADX Proxy cluster

Run queries on your LA or AI cluster. Verify that your cluster is selected in the left pane.

Perf | take 10 // Demonstrate query through the proxy on the LA workspace

Query LA workspace

Cross query of your LA or AI ADX Proxy cluster and the ADX native cluster

When you run cross cluster queries from the proxy, verify your ADX native cluster is selected in the left pane. The following examples demonstrate combining ADX cluster tables (using union) with LA workspace.

union StormEvents, cluster('https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>').database('<workspace-name>').Perf
| take 10 
let CL1 = 'https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>';
union <ADX table>, cluster(CL1).database(<workspace-name>).<table name>

Cross query from the Azure Data Explorer proxy

Using the join operator, instead of union, may require a hint to run it on an Azure Data Explorer native cluster (and not on the proxy).

Additional syntax examples

The following syntax options are available when calling the Application Insights (AI) or Log Analytics (LA) clusters:

Syntax Description Application Insights Log Analytics
Database within a cluster that contains only the defined resource in this subscription (recommended for cross cluster queries) cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.insights/components/<ai-app-name>').database('<ai-app-name>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>').database('<workspace-name>)
Cluster that contains all apps/workspaces in this subscription cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>)
Cluster that contains all apps/workspaces in the subscription and are members of this resource group cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>)
Cluster that contains only the defined resource in this subscription cluster(https://ade.applicationinsights.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.insights/components/<ai-app-name>) cluster(https://ade.loganalytics.io/subscriptions/<subscription-id>/resourcegroups/<resource-group-name>/providers/microsoft.operationalinsights/workspaces/<workspace-name>)

Next steps

Write queries